Executive brief
A synchronization flaw was identified in the Linux kernel's USB dummy host controller driver. This vulnerability can cause a system crash (kernel panic) when a USB device reset occurs simultaneously with a driver being removed. While it primarily affects system stability and availability, it could be used by a local user to disrupt operations or cause a denial-of-service on the affected machine.
Technical details
A race condition exists in the dummy-hcd driver (drivers/usb/gadget/udc/dummy_hcd.c) due to improper locking in the set_link_state() function. The stop_activity() routine can drop and re-acquire the 'dum->lock' spinlock, creating a window where another thread performing a driver unbind can clear 'dum->driver'. If this occurs before 'dum->callback_usage' is incremented, the subsequent call to usb_gadget_udc_reset() receives a NULL driver argument, leading to an addressing exception and kernel crash. The fix involves incrementing the callback usage counter before calling stop_activity() to ensure the driver remains bound until the reset routine completes.
Affected products
- Linux Linux Kernel All versions prior to the fix in dummy-hcd driver
Timeline
- 2026-03-15: patched: Initial patch authored by Alan Stern
- 2026-05-08: disclosed: CVE-2026-43327 published
References
- https://git.kernel.org/stable/c/218886b2ef2dea7627d3700ab0abaf4bf9d1161f
- https://git.kernel.org/stable/c/616a63ff495df12863692ab3f9f7b84e3fa7a66d
- https://git.kernel.org/stable/c/6350c7dd33ab481ef41c931a238361490c32d15c
- https://git.kernel.org/stable/c/69ab97a693251d6a6093e630060a3c744fd58524
- https://git.kernel.org/stable/c/791966f85b439b261bf19865cf1c07c065ffb4b4
- https://git.kernel.org/stable/c/805b1833d6ed6da5086e610578a28e71bb54fbbb
- https://git.kernel.org/stable/c/cc97fb5969177cccce2e23b31298df220fc7570d